CVE-2020-25757 is a critical vulnerability affecting D-Link DSR VPN routers (DSR-150, DSR-250, DSR-500, DSR-1000AC with firmware 3.14 and 3.17). It stems from insufficient input validation and access controls in Lua CGIs, allowing for arbitrary command execution with root privileges. With a CVSS score of 8.8 (HIGH), this vulnerability can be exploited by an unauthenticated attacker over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. Its EPSS score is low, indicating a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, suggesting a low profile despite its high severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.17CPE matchmatch criteria | cpe:2.3:o:dlink:dsr-150_firmware:*:*:*:*:*:*:*:* | ||
<= 3.17CPE matchmatch criteria | cpe:2.3:o:dlink:dsr-150n_firmware:*:*:*:*:*:*:*:* | ||
<= 3.17CPE matchmatch criteria | cpe:2.3:o:dlink:dsr-250_firmware:*:*:*:*:*:*:*:* | ||
<= 3.17CPE matchmatch criteria | cpe:2.3:o:dlink:dsr-250n_firmware:*:*:*:*:*:*:*:* | ||
<= 3.17CPE matchmatch criteria | cpe:2.3:o:dlink:dsr-500_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.